# What Is an Attack Vector? Common Types and Defenses

> A defensive explainer on attack vectors: what an attack vector is and how it differs from the attack surface, the most common vectors including phishing, stolen credentials, unpatched vulnerabilities, misconfigurations, supply-chain compromise, insiders and physical access, and how layered controls and reducing the attack surface defend against them.

Source: https://playciso.com/blog/what-is-an-attack-vector · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

---

An attack vector is the specific path or method an attacker uses to gain unauthorized access to a system, network or data — the route in. A phishing email, a stolen password, an unpatched internet-facing server, a misconfigured cloud bucket, a compromised supplier: each is a different vector, a different way of crossing from outside your control to inside it. ## Attack vector versus attack surface These two terms are closely related and often muddled, so pin them down first. - The attack surface is the total set of all points where an attacker could potentially try to get in — every exposed service, open port, endpoint, user account, API and third-party integration you have. - An attack vector is one specific path through that surface that an attacker actually uses — a particular phishing email, a particular unpatched server, a particular leaked credential. The relationship is direct and worth internalizing: the larger your attack surface, the more vectors are available to an attacker, and shrinking the surface by removing unnecessary exposure directly removes vectors. The surface is the whole set of doors and windows; a vector is the one an intruder climbs through. This is why "reduce the attack surface" is such consistent advice — it is the cheapest way to take vectors off the board entirely. ## The common vectors A relatively small set of vectors accounts for the large majority of real-world compromise. Knowing them tells you where defensive effort pays off. - Phishing and social engineering. Tricking a person into clicking a link, opening an attachment, entering credentials or approving a request. Manipulating a human is often cheaper than defeating technology, which is why it remains one of the most common initial vectors. - Stolen, weak or reused credentials. A valid login lets an attacker walk in through the front door without any exploit at all. Password reuse and credential theft turn one breach into many. - Unpatched known vulnerabilities. An exposed service with a known, unfixed flaw is a standing invitation. Most compromises use known vulnerabilities, not zero-days — the gap is patching speed, not attacker brilliance. - Misconfiguration. Storage, databases or services left open, overly permissive access, default credentials never changed. These are self-inflicted vectors that continuous monitoring catches and one-time setup does not. - Supply-chain compromise. Getting in through a trusted vendor, contractor or software update, so the malicious access arrives wrapped in legitimacy. - Insider threat. A malicious or simply careless person who already has access, bypassing the perimeter entirely. - Physical access. Stolen devices, unauthorized entry, media that was not destroyed — physical access defeats many logical controls. The recurring pattern is that people, credentials and unpatched exposure dominate. Exotic vectors make headlines; the mundane ones do most of the damage. ## Reasoning about vectors: threat modeling You cannot defend vectors you have not identified. The discipline of enumerating the realistic ways an attacker could reach a given asset — and deciding which controls block each one — is [threat modeling](/tools/threat-model). Done well, it turns a vague worry about "getting hacked" into a concrete list of vectors with a named control against each, and surfaces the vector that currently has nothing in its way. Thinking in vectors also pairs naturally with detection: once you know the paths, you know where to place sensors like an [intrusion detection system](/blog/what-is-an-ids) so an attempt to use a vector is seen. ## How to defend Defending against attack vectors means doing two things at once: reducing how many vectors exist, and layering controls so no single vector is decisive. - Shrink the surface. Remove unnecessary services, accounts, ports and exposure. Every removal deletes vectors outright. - Phishing-resistant MFA. Directly addresses both the phishing and the stolen-credential vectors — the two biggest — by making a stolen password insufficient on its own. - Patch promptly. Close the vulnerability vectors on anything exposed, prioritizing what is internet-facing and actively exploited. - Harden configurations and monitor them continuously, so misconfiguration vectors are closed and stay closed. - Review your suppliers to address supply-chain vectors, and limit what third parties can reach. - Enforce least privilege and segment the network so that even when a vector succeeds, it reaches as little as possible. - Train people, because the human vectors are defended partly by the humans themselves. This is simply [defense in depth](/blog/defense-in-depth-explained) expressed in the language of vectors, and it dovetails with a [zero-trust](/tools/zero-trust) posture that refuses to treat any single successful vector as a reason to trust what follows. The objective is never to make one route perfect; it is to ensure that closing — or failing to close — any single vector does not hand an attacker the whole environment. ## Frequently asked questions **What is an attack vector?** The specific method or path an attacker uses to gain unauthorized access — phishing, stolen credentials, an unpatched vulnerability, a misconfiguration, a compromised supplier, an insider, or physical access. **How does it differ from the attack surface?** The attack surface is every possible point of entry; an attack vector is one specific route through it that an attacker actually uses. A smaller surface means fewer vectors. **What are the most common vectors?** Phishing and social engineering, stolen or weak credentials, and unpatched known vulnerabilities, followed by misconfiguration, supply-chain compromise, insiders and physical access. **What is the most common attack vector?** Phishing and social engineering, usually combined with stolen or weak credentials, because manipulating people and using valid logins is often easier than defeating technology. **How do you defend against them?** Reduce the attack surface and layer independent controls: phishing-resistant MFA, prompt patching, hardening and monitoring, vendor review, least privilege, segmentation and awareness training.